CVE-2026-58494

MEDIUM 6.5

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

CVSS Score

6.5

EPSS Score

0.1%

EPSS Percentile

2th

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.

CWE	CWE-281 CWE-863
Vendor	bytecodealliance
Product	wasmtime
Published	Jul 8, 2026
Last Updated	Jul 9, 2026

Stay Ahead of the Next One

Get instant alerts for bytecodealliance wasmtime

Be the first to know when new medium vulnerabilities affecting bytecodealliance wasmtime are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

bytecodealliance / wasmtime

< 24.0.11 >= 25.0.0, < 36.0.12 >= 37.0.0, < 45.0.3 >= 46.0.0, < 46.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗